Knowledge Graph-Based DDoS Attack Detection for UAV-Assisted Space–Air–Ground Integrated Networks

Distributed denial-of-service (DDoS) attacks pose a serious threat to the availability and reliability of unmanned aerial vehicle (UAV)-assisted Space–Air–Ground Integrated Networks (SAGIN). In such networks, UAVs can serve as aerial access points, mobile relays, and lightweight edge nodes to provide flexible connectivity between ground users and satellite networks. However, UAV mobility, time-varying network topology, heterogeneous communication links, and constrained airborne resources lead to highly dynamic traffic patterns and cross-layer attack surfaces, making conventional DDoS detection methods difficult to directly apply. To address these challenges, this paper proposes DDoSPre-LLM, a knowledge-graph-based DDoS detection framework for UAV-assisted SAGIN. First, MulFea-LLM employs large language models to extract multidimensional attack entities and semantic relations from heterogeneous security data and constructs a SAGIN-oriented attack knowledge graph containing attack, traffic, network-resource, and UAV-related entities. Then, a graph-attention-based feature weighting mechanism dynamically evaluates the contributions of traffic volume, request frequency, access-point connections, and bandwidth utilization to different DDoS attacks. The proposed method is evaluated in a SAGIN simulation environment integrating moving UAV access/relay nodes, satellite links, and terrestrial networks. Simulation results demonstrate improved detection accuracy, F1-score, and QoS compliance, with competitive recall, AUC-ROC, and throughput preservation, compared with representative baseline methods.